Insomnia RAT persistence via fake 'Maps Performance Task' scheduled task
Detects the creation or modification of a scheduled task named 'Maps Performance Task' using schtasks.exe or reg.exe. This task is often associated with legitimate Windows system maintenance related to map data but may be monitored as it involves persistence mechanisms.
Microsoft Sentinel (KQL)
